What is blocked in 2.2.9?

[ilkeraktuna]

Hi,

Can somebody explain what is meant by :

Note: This release includes enhanced security measures that disable insecure access to the hub from outside local network using port forwarding or similar means. No IOT device is meant to be accessed publicly, and our hub is no exception. Use Hubitat Remote Admin, a private VPN, or other secure means of access instead.

I mean, when port forwarding is used, actually an internal IP is accessing the Hub on behalf of the external user.
So if you do not block access to port 443 , you can not block port forwarding.
So what's new with this block ?

[ritchierich]

2.2.9 Security Enhancements?

Would it be possible for the technical details of what specifically is being changed with regards to the Security Enhancements? enhanced security measures that disable insecure access to the hub from outside local network using port forwarding or similar means. No IOT device is meant to be accessed publicly, and our hub is no exception. Use Hubitat Remote Admin, a private VPN, or other secure means of access instead. What was changed - ie was the source IP of the browser request for admin chec…

[thebearmay]

It’s not so much the port, as it is that it is trying to be used from a public address:

@gopher.ny

Hub will accept incoming connections from private address IPs and subnets explicitly defined by using /hub/allowSubnets?123.123.123.0,124.124.124.0 endpoint.

[gopher.ny]

@ilkeraktuna

I mean, when port forwarding is used, actually an internal IP is accessing the Hub on behalf of the external user.

Many ISP routers (and we obviously have't tested every single one of them) simply forward requests with original IP address intact. And yeah, if the request comes from a private address space but IP has manipulated using NAT mapping or whatnot, hub will not know that. But we have to assume that people who can set up their home networks in this manner know better than exposing their local IOT device to the world without additional security in place.

[ilkeraktuna]

Ok. but my port forwarding rule (on router) does actually inbound source nat.
So when an external IP accesses the port forwarding rule, it actually uses the router's internal IP (192.168.1.1)
So basically 192.168.1.1 accesses the hub (192.168.1.10)
this is a total local access.
How can Hubitat block this ?

Also, how can I use the /hub/allowSubnets? endpoint ?
is there a way to see what IP subnets are already allowed ?

[gopher.ny]

@ilkeraktuna

So basically 192.168.1.1 accesses the hub (192.168.1.10) this is a total local access.
How can Hubitat block this ?

The hub looks at the source IP of the incoming connection, so it shouldn't block anything in the scenario above.

@ilkeraktuna

is there a way to see what IP subnets are already allowed ?

By default, all private address space subnets are.

[ilkeraktuna]

ok. if I need to add a statik IP address to that , how can I use the endpoint ?
just send a GET request to:
http://HUB_IP/hub/allowSubnets?a.b.c.d

?
what about if I want to delete it afterwards ?

[gopher.ny]

@ilkeraktuna

what about if I want to delete it afterwards ?

It's a full replace whenever you run the endpoint, so http://HUB_IP/hub/allowSubnets? (without query string) will reset it.